How should MSPs respond to the FBI email phishing surge?

The FBI's Internet Crime Complaint Center (IC3) has ranked phishing and spoofing as the single most-reported crime type two years running — 193,407 complaints in 2024 and 298,878 in 2023, per the FBI IC3 annual reports. For MSPs, that isn't a headline to react to; it's a standing condition to build a service around. Here's what the data actually says and where you can move the needle for clients.

Quick Takeaways

• Phishing/spoofing is the #1 IC3 crime type by complaint volume — 193,407 complaints in 2024, ahead of extortion (86,415) and personal data breach (64,882), per the FBI IC3 2024 report.
• Phishing's direct reported loss is comparatively small ($70,013,036 in 2024). The real money is in Business Email Compromise: $2.77 billion in 2024 losses from just 21,442 complaints — a phishing-adjacent attack that spoofing enables.
• The controls that address this are the boring, proven ones: SPF, DKIM, DMARC at p=reject, and MFA — the same stack CISA mandated for federal agencies in BOD 18-01.
• A p=reject DMARC policy is, in CISA's words, the strongest protection against spoofed email — it tells receiving servers to block messages that fail authentication for your domain.
• Palisade's hosted DMARC lets an MSP take a client from monitoring to reject from a dashboard slider, and turns aggregate reports into readable charts instead of raw XML — so enforcement across a portfolio is a repeatable process, not a per-domain research project.

What does the FBI data actually say about phishing?

Read the IC3 numbers carefully, because the loudest stat isn't the most important one. Phishing/spoofing tops the complaint count every year, but its directly reported loss was $70,013,036 in 2024 — a rounding error next to the year's costliest categories. The FBI IC3 2024 report puts total losses across all crime types at $16.6 billion (a 33% jump over 2023), with investment fraud the costliest single type at roughly $6.57 billion and BEC second at about $2.77 billion.

Figures from the FBI IC3 2024 report: phishing leads complaint volume; BEC drives the losses.

The takeaway for an MSP: phishing is rarely the crime that empties the account. It's the entry point. A credential harvested through a convincing spoofed email becomes the compromised mailbox that a BEC scheme runs through. The IC3 describes BEC exactly this way — an attacker compromises a legitimate business email account, then uses it to redirect payments. And the scale is enormous: the FBI's September 2024 PSA on BEC reported $55,499,915,582 in exposed losses across 305,033 incidents between October 2013 and December 2023, spanning all 50 states and 186 countries. (That's a cumulative decade-plus figure, not a single year — but it shows where spoofing ultimately leads.)

Which controls actually address this, per CISA and IC3?

CISA and IC3 recommend controls, not products. The clearest blueprint is CISA's Binding Operational Directive 18-01, which required federal agencies to publish SPF records, sign outbound mail with DKIM, and set a DMARC policy of p=reject. Three of those work together:

• SPF lists the IPs allowed to send for your domain. Check any client's record with the SPF tool.
• DKIM cryptographically signs outbound mail so receivers can verify it wasn't altered. Verify signing with the DKIM tool.
• DMARC ties them together — it tells receiving servers what to do when a message fails both checks: monitor (p=none), quarantine, or reject.

CISA calls p=reject the strongest protection against spoofed email because unauthenticated messages impersonating the domain get blocked at the mail server before a user ever sees them. On the account side, CISA's MFA campaign frames multi-factor authentication as making an account "99% less likely to get hacked," and points to phishing-resistant MFA (FIDO/WebAuthn) as the strongest form. Treat that 99% as CISA's awareness-campaign framing rather than a precise lab figure — but the direction is not in dispute.

How should an MSP prioritize across a client base?

Don't boil the ocean. Sequence it:

The sequence from this article; DMARC enforcement is the highest-leverage first move.

1. Get every client domain to DMARC enforcement. This is the highest-leverage move because it structurally kills exact-domain spoofing — the technique behind the spoofing complaints IC3 counts. Start each domain at p=none to inventory senders, fix SPF/DKIM alignment, then ramp to quarantine and reject.
2. Enforce MFA everywhere, and push phishing-resistant MFA (FIDO/WebAuthn) for finance staff and executives — the roles a BEC attacker targets.
3. Lock down the mailbox mechanics attackers abuse: restrict external auto-forwarding rules and audit OAuth app grants, which can bypass MFA entirely.
4. Train against the current pattern — urgency, spoofed sender names, and payment-change requests — and rehearse a short incident-response playbook: isolate the account, revoke tokens, force a password and MFA reset.

The bottleneck on step 1 is almost always the DNS work. Getting one domain from none to reject means several record changes over weeks; across fifty client domains, that's where DMARC projects stall for months.

Where does Palisade fit for an MSP?

Palisade is built for exactly the step-1 bottleneck. With hosted DMARC, the client adds one CNAME at _dmarc. delegating to Palisade, and Palisade publishes and maintains the actual record. From then on, policy changes — none → quarantine (with a percentage ramp) → reject — happen from a dashboard slider with a diff preview before anything is applied. A status badge (Verifying → Active, or Error) tells you where each domain stands.

Just as important for defending against BEC: Palisade parses the DMARC aggregate (rua) reports into readable charts in a Reports tab, so you can see who's spoofing a client's domain and confirm every legitimate sender passes before you tighten policy — no raw XML. Across a portfolio, that turns enforcement into a batch process instead of fifty separate DNS tickets. Palisade doesn't do the training or the mailbox forensics — but it removes the reason DMARC enforcement usually gets deferred.

Frequently asked questions

Is phishing really the biggest email threat if its losses are low?

By complaint volume, yes — it's the #1 IC3 crime type. By dollars, the direct phishing loss was $70M in 2024, while BEC (which spoofing enables) drove about $2.77 billion. Read them together: phishing is the entry point, BEC is the payout.

Does DMARC stop phishing?

It stops one specific, high-value technique: mail that spoofs your exact domain. At p=reject, receiving servers block those messages. It won't catch look-alike domains or attacks from a genuinely compromised account — which is why MFA, filtering, and training sit alongside it.

Is MFA enough on its own?

No. CISA credits MFA with making accounts far harder to compromise, but attackers use MFA-bypass and OAuth-consent abuse. Pair it with phishing-resistant methods (FIDO/WebAuthn), and audit connected app grants regularly.

How fast can we get a client to DMARC enforcement?

A domain with clean SPF/DKIM alignment can reach reject in weeks — the pacing is set by how quickly you confirm every legitimate sender passes at p=none. With hosted DMARC, each policy step is a dashboard change, not a DNS ticket, so enforcement day doesn't wait on the client's IT.

What should we preserve after a suspected mailbox compromise?

Authentication logs, full email headers, mailbox forwarding rules, and OAuth consent grants — plus any DMARC reports showing the spoofing. Those establish timeline and scope before you revoke tokens and reset credentials.

Want a fast read on any client domain? Run the free Email Security Score — it checks DMARC, SPF, and DKIM posture in seconds.

Related reading

• DMARC checker
• Microsoft compliance checker
• Palisade for Managed Service Providers